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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions and listings of claims in the 
application: 

1 . (Currently Amended) A method for addressing packets in a firewall cluster 
within a single network, the firewall cluster including a plurality of firewall nodes 
comprising one or more processing units, the method comprising: 

selecting, from the firewall cluster within the single network, a first firewall node 
for processing a first packet; 

receiving, at a first processing unit associated with the first firewall node, the first 
packet; 

modifying, by the first processing unit, as a function of a mu l tidim e nsiona l n-tuple 
space for representing addresses processed by a set of processing units, a first address 
for the first packet into a second address for the first packet, the second address being 
within a range of addresses assigned only to the first firewall node; 

selecting, from the firewall cluster within the single network, a second firewall 
node for processing a second packet; 

receiving, at a second processing unit associated with the second firewall node, 
the second packet , the second processing unit being different than the first processing 
unit ; 

modifying, by the second processing unit, as a function of a mu l tidim e nsiona l 
n-tuple space for representing addresses processed by a set of processing units, a first 
address for the second packet into a second address for the second packet, the second 
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address being within a range of addresses assigned only to the second firewall node, 

such that the second address of the second packet does not conflict with the second 

address of the first packet; 

forwarding the first packet based on the second address of the first packet; and 
forwarding the second packet based on the second address of the second 

packet. 

2. (Cancelled). 

3. (Currently Amended) The method of claim [[2]] 1, further comprising: 
assigning to the first processing unit a first region based on the N-tuple space. 

4. (Previously Presented) The method of claim 3, further comprising: 
using the first address of the first packet, such that the first address represents a 

point within the first region. 

5. (Original) The method of claim 4, further comprising: 

using N address values as the N-tuple, such that the N address values represent 
the point. 

6. (Currently Amended) The method of claim [[2]] 1, further comprising: 
using the N-tuple space, such that N is equal to a value of at least two. 

7. (Previously Presented) The method of claim 3, further comprising: 
assigning to a second processing unit a second region based on the N-tuple 

space, such that the first region is separate from the second region. 
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8. (Cancelled). 

9. (Cancelled). 

10. (Currently Amended) A method for addressing packets associated with a 
plurality of processing units, each processing unit being associated with one of a 
plurality of firewall nodes in a firewall cluster within a single network, the method 
comprising: 

selecting, from the firewall cluster within the single network, one of the firewall 
nodes for processing a packet, the selected firewall node including a first processing 
unit; 

receiving, at the first processing unit, the packet; 

reading, at the first processing unit, an N-tuple address of the received packet; 

determining, by the first processing unit, whether the N-tuple address of the 
received packet is within an N-tuple space assigned to the first processing unit based 
on a quadrant identifier value assigned to the first processing unit , wherein the N-tuple 
space assigned to each of the plurality of processing units is differen t, and wherein the 
guadrant identifier is determined using a hash function : 

sending the packet with the N-tuple address, when it is determined that the N- 
tuple address is within the N-tuple space assigned to the first processing unit; 

determining, when the N-tuple address of the received packet is not within the 
N-tuple space assigned to the first processing unit, a modified N-tuple address based 
on the N-tuple space assigned to the first processing unit, such that the modified 
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N-tuple address does not conflict with addresses assigned by any of the other plurality 
of processing units; and 

sending the packet based on the modified N-tuple address. 

1 1 . (Original) The method of claim 1 0, wherein the reading step further 
comprises: 

reading as the N-tuple address, a plurality of values from the received packet. 

12. (Original) The method of claim 1 1 , wherein the reading step further 
comprises: 

reading at least a source port. 

13. -15. (Cancelled). 

16. (Currently Amended) The method of claim [[14]] 10, wherein the step of 
determining whether the N-tuple address of the packet is within the N-tuple space, 
further comprises: 

determining the quadrant identifier value based on a hash function and a modulo 
division. 

17. (Previously Presented) The method of claim 10, wherein the step of 
determining the modified N-tuple further comprises: 

adding a value to the N-tuple address, such that the modified N-tuple address is 
within the N-tuple space assigned to the first processing unit. 
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18.-20. (Cancelled). 

21 . (Previously Presented) The method of claim 1 0, further comprising: 
using a computer as the first processing unit. 

22. (Previously Presented) The method of claim 10, further comprising: 
using a router as the first processing unit. 

23. (Cancelled). 

24. (Previously Presented) A method of addressing packets in a firewall 
cluster within a singe network, wherein the firewall cluster comprises a set of processing 
units, each processing unit being associated with a firewall node, the method 
comprising: 

selecting, from the firewall cluster within the single network, one of the firewall 
nodes for processing a packet, the selected firewall node including a first processing 
unit; 

receiving, at the first processing unit, the packet; 

reading, at the first processing unit, an N-tuple address of the received packet; 

determining a quadrant identifier based on the read N-tuple address, a hash 
function, and modulo division; 

determining whether the read N-tuple address corresponds to the first processing 
unit based on the quadrant identifier; 

sending the packet with the N-tuple address, when the quadrant identifier 
corresponds to the first processing unit; and 
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determining, when the quadrant identifier does not correspond to the first 
processing unit, a modified N-tuple address that corresponds to the first processing unit, 
such that the modified N-tuple address does not conflict with addresses assigned by 
any of the other processing units; and 

sending the packet based on the modified N-tuple address. 

25. (Previously Presented) The method of claim 24, further comprising: 
assigning each of the set of processing units a firewall node number. 

26. (Previously Presented) The method of claim 25, further comprising: 
determining whether the N-tuple address corresponds to the first processing unit 

based on the quadrant identifier and the firewall node number. 

27. (Currently Amended) A system for addressing packets in a firewall cluster 
within a single network, the firewall cluster including a plurality of firewall nodes, the 
system comprising: 

means for selecting, from the firewall cluster within the single network, a first 
firewall node for processing a first packet; 

means for receiving, at a first processing unit associated with the first firewall 
node, the first packet; 

means for modifying, as a function of a multidim e nsiona l n-tuple space for 
representing addresses processed by a set of processing units, a first address for the 
first packet into a second address for the first packet, the second address being within a 
range of addresses assigned only to the first firewall node; 
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means for selecting, from the firewall cluster within the single network, a second 
firewall node for processing a second packet; 

means for receiving, at a second processing unit associated with the second 
firewall node, the second packet , the second processing unit being different than the 
first processing unit : 

means for modifying, as a function of a multid i mons i onal n-tuple space for 
representing addresses processed by a set of processing units, a first address for the 
second packet into a second address for the second packet, the second address being 
within a range of addresses assigned only to the second firewall node, such that the 
second address of the second packet does not conflict with the second address of the 
first packet; 

means for forwarding the first packet based on the second address of the first 
packet; and 

means for forwarding the second packet based on the second address of the 
second packet. 

28. (Currently Amended) A system for addressing packets associated with 
one or more processing units, each processing unit being associated with a firewall 
node in a firewall cluster within a single network, the system comprising: 

means for selecting, from the firewall cluster within the single network, one of the 
firewall nodes for processing a packet, the selected firewall node including a first 
processing unit; 

means for receiving, at the first processing unit, the packet; 
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means for reading, at the first processing unit, an N-tuple address of the received 
packet; 

means for determining whether the N-tuple address of the received packet is 
within an N-tuple space assigned to the first processing unit based on a quadrant 
identifier value assigned to the first processing unit , wherein the N-tuple space assigned 
to each of the processing units is different , and wherein the guadrant identifier is 
determined using a hash function : 

means for sending the packet with the N-tuple address, when it is determined 
that the N-tuple address is within the N-tuple space assigned to the first processing unit; 
and 

means for determining, when the N-tuple address of the received packet is not 
within the N-tuple space assigned to the first processing unit, a modified N-tuple 
address based on the N-tuple space assigned to the first processing unit, such that the 
modified N-tuple address does not conflict with addresses assigned by any of the other 
processing units; 

and sending the packet based on the modified N-tuple address. 

29. (Previously Presented) A firewall cluster within a single network including 
firewall nodes associated with processing units, comprising: 

means for selecting, from the firewall cluster within the single network, one of the 
firewall nodes for processing a packet, the selected firewall node including a first 
processing unit; 

means for receiving, at the first processing unit, the packet; 
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means for reading, at the first processing unit, an N-tuple address of the received 
packet; 

means for determining a quadrant identifier based on the read N-tuple address, a 
hash function, and modulo division; 

means for determining whether the read N-tuple address corresponds to the first 
processing unit based on the quadrant identifier; 

means for sending the packet with the N-tuple address, when the quadrant 
identifier corresponds to the first processing unit; and 

means for determining, when the quadrant identifier does not correspond to the 
first processing unit, a modified N-tuple address that corresponds to the first processing 
unit, such that the modified N-tuple address does not conflict with addresses assigned 
by any of the other processing units; 

and sending the packet based on the modified N-tuple address. 

30. (Currently Amended) A system including a firewall cluster within a single 
network including a plurality of firewall nodes, the firewall nodes being associated with 
one or more processing units, said system comprising: 
at least one memory comprising: 

code that selects, from the firewall cluster within the single network, 
a first firewall node for processing a first packet, the first firewall node including a 
first processing unit; 

code that receives, at the first processing unit, the first packet; 
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code that modifies, as a function of a multid i m e ns i onal n-tuple 
space for representing addresses processed by a set of data processing units, a 
first address for the first packet into a second address for the first packet, the 
second address being within a range of addresses assigned only to the first 
firewall node; 

code that selects, from the firewall cluster within the single network, 
a second firewall node for processing a second packet; the second firewall node 
including a second processing unit; 

code that receives, at the second processing unit, the second 
packe t, the second processing unit being different than the first processing unit ; 

code that modifies as a function of a multid i m e nsional n-tuple 
space for representing addresses processed by a set of processing units, a first 
address for the second packet into a second address for the second packet, the 
second address being within a range of addresses assigned only to the second 
firewall node, such that the second address of the second packet does not 
conflict with the second address of the first packet; 

code that forwards the first packet based on the second address of 
the first packet; and 

code that forwards the second packet based on the second 
address of the second packet; and 

at least one processing unit for executing the code. 
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31 . (Currently Amended) A system including a firewall cluster within a single 
network including a plurality of firewall nodes, the firewall nodes being associated with 
processing units, the system comprising: 

at least one memory comprising: 

code that selects, from the firewall cluster within the single network, 
one of the firewall nodes for processing a packet, the selected firewall node 
including a first processing unit; 

code that receives, at the first processing unit, the packet; 

code that reads, at the first processing unit, an N-tuple address of 
the received packet; 

code that determines whether the N-tuple address of the received 
packet is within an N-tuple space assigned to the first processing unit based on a 
quadrant identifier value assigned to the first processing unit , wherein the N-tuple 
space assigned to each of the processing units is different , and wherein the 
quadrant identifier is determined using a hash function : 

code that sends the packet with the N-tuple address, when it is 
determined that the N-tuple address is within the N-tuple space assigned to the 
first processing unit; 

code that determines, when the N-tuple address of the received 
packet is not within the N-tuple space assigned to the first processing unit, a 
modified N-tuple address based on the N-tuple space assigned to the first 
processing unit, such that the modified N-tuple address does not conflict with 
addresses assigned by any of the other processing units; 
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and sending the packet based on the modified N-tuple address; 

and 

at least one processing unit for executing the code. 

32. (Original) The system of claim 31, wherein code that reads further 
comprises: 

code that reads as the N-tuple address, a plurality of values from the received 
packet. 

33. (Original) The system of claim 32, wherein code that reads the plurality of 
values further comprises: 

code that reads at least a source port. 

34. -36. (Cancelled). 

37. (Previously Presented) A firewall cluster including a plurality of firewall 
nodes within a single network, the firewall nodes being associated with processing 
units, the firewall cluster comprising: 

at least one memory comprising 

code that selects, from the firewall cluster within the single network, 
one of the firewall nodes for processing a packet, the selected firewall node 
including a first processing unit; 

code that receives, at the first processing unit, the packet; 
code that reads, at the first processing unit, an N-tuple address of 
the received packet; 
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code that determines a quadrant identifier based on the read 
N-tuple address, a hash function, and modulo division; 

code that determines whether the read N-tuple address 
corresponds to the first processing unit based on the quadrant identifier; 

code that sends the packet with the N-tuple address, when the 
quadrant identifier corresponds to the first processing unit; and 

code that determines, when the quadrant identifier does not 
corresponds to the first processing unit, a modified N-tuple address that 
corresponds to the first processing unit, such that the modified N-tuple address 
does not conflict with addresses assigned by any of the other processing units; 
and 

code that sends the packet based on the modified N-tuple address; 

and 

at least one processing unit for executing the code. 

38. (Currently Amended) A computer-readable storage medium comprising 
instructions which, when executed by a processing unit, perform a method for 
addressing packets in a firewall cluster within a single network, the firewall cluster 
including a plurality of firewall nodes, the method including: 

selecting, from the firewall cluster within the single network, one of the firewall 
nodes for processing a packet, the selected firewall node being associated with a first 
processing unit; 

receiving, at the first processing unit, the packet; 
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reading, at the first processing unit, an N-tuple address of the received packet; 

determining whether the N-tuple address of the received packet is within an N- 
tuple space assigned to the first processing unit based on a quadrant identifier value 
assigned to the first processing unit , wherein the N-tuple space assigned to each of the 
processing units is differen t, and wherein the guadrant identifier is determined using a 
hash function : 

sending the packet with the N-tuple address, when it is determined that the 
N-tuple address is within the N-tuple space assigned to the first processing unit; and 

determining, when it is determined that the N-tuple address of the received 
packet is not within the N-tuple space assigned to the first processing unit, a modified 
N-tuple address based on the N-tuple space assigned to the first processing unit, such 
that the modified N-tuple address does not conflict with addresses assigned by any of 
the other processing units; and 

sending the packet based on the modified N-tuple address. 

39. (Previously Presented) The computer-readable storage medium of claim 

38, wherein reading further comprises: 

reading as the N-tuple address, a plurality of values from the received packet. 

40. (Previously Presented) The computer-readable storage medium of claim 

39, wherein reading the plurality of values further comprises: 

reading at least a source port. 

41. -43. (Cancelled). 
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44. (Previously Presented) A computer-readable storage medium comprising 
instructions which, when executed by a processing unit, perform a method for 
addressing packets in a firewall cluster within a single network, the firewall cluster 
including a plurality of firewall nodes, the method including: 

selecting, from the firewall cluster within the single network, one of the firewall 
nodes for processing a packet, the selected firewall node including a first processing 
unit; 

receiving, at the first processing unit, the packet; 

reading, at the first processing unit, an N-tuple address of the received packet; 

determining a quadrant identifier based on the read N-tuple address, a hash 
function, and modulo division; 

determining whether the read N-tuple address corresponds to the first processing 
unit based on the quadrant identifier; 

sending the packet with the N-tuple address, when the quadrant identifier 
corresponds to the first processing unit; and 

determining, when the quadrant identifier does not corresponds to the first 
processing unit, a modified N-tuple address that corresponds to the first processing unit, 
such that the modified N-tuple address does not conflict with addresses assigned by 
any of the other processing units; 

and sending the packet based on the modified N-tuple address. 
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45. (Currently Amended) A computer-readable storage medium comprising 
instructions which, when executed by a processing unit, perform a method for 
addressing packets in a firewall cluster within a single network, the firewall cluster 
including a plurality of firewall nodes comprising one or more processing units, the 
method including: 

selecting, from the firewall cluster within the single network, one of the firewall 
nodes within the single network for processing a first packet, the selected firewall node 
being associated with a first processing unit; 

receiving, at the first processing unit, the first packet; 

modifying, as a function of a mu l tidimensional n-tuple space for representing 
addresses processed by a set of data processing units, a first address for the first 
packet into a second address for the first packet, the second address being within a 
range of addresses assigned only to the selected firewall node; 

selecting, from the firewall cluster within the single network, a second firewall 
node for processing a second packet; 

receiving, at a second processing unit associated with the second firewall node, 
the second packet , the second processing unit being different than the first processing 
unit ; 

modifying, by the second processing unit, as a function of a mu l tid i m e ns i onal rv 
tuple space for representing addresses processed by a set of processing units, a first 
address for the second packet into a second address for the second packet, the second 
address being within a range of addresses assigned only to the second firewall node, 
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such that the second address of the second packet does not conflict with the second 

address of the first packet; 

forwarding the first packet based on the second address of the first packet; and 
forwarding the second packet based on the second address of the second 

packet. 
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